ENGIE Discloses Customer Data Breach via Partner Platform
French energy giant ENGIE confirmed attackers stole customer data after compromising a third-party marketing platform used by its business partners.
Morgan "airgap" ReyesENGIE, one of the world’s largest power and natural gas providers, confirmed a data breach affecting customer records. Attackers accessed a marketing platform used by the company’s business partners and extracted customer data. BleepingComputer reported October 27 that ENGIE has notified affected customers.
The breach vector is a third-party marketing platform used by partners, not ENGIE’s core energy systems. No CVE or specific technical details about the attack method have been disclosed.
Scope
ENGIE has not published the number of affected customers. Breach notification letters are going out. The company confirmed customer data was taken but has not specified which categories of records were involved. No ransomware group has claimed the incident. No indication of financial account or payment card data in scope based on current disclosure.
Analysis: Phishing campaigns targeting affected customers using stolen contact details are a common follow-on to this type of breach; no specific campaigns have been observed as of publication.
Related coverage: Quest Diagnostics Discloses Patient Data Breach.
Found this useful? Share it.
